Skip to content
OpenAdvisories
Critical · 9.4 CVE-2023-22644 EUVD-2023-26778GHSA-6q6r-hx29-59m5GO-2024-3201

JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

Published Sep 20, 2023 · Updated Apr 7, 2025 · Assigned by suse

Vendor: SUSE Product: NeuVector Package: github.com/neuvector/neuvector Ecosystem: Go

Description

A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.

Affected products

VendorProductAffectedFixed
SUSE neuvector < 0.0.0-20231003121714-be746957ee7c 0.0.0-20231003121714-be746957ee7c

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
SLES 15 SP5 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Package Hub 12 govulncheck-vulndb 0.0.20241104T154416-5.1 openSUSE-SU-2024:0350-1
SUSE Manager Server Module 4.3 branch-network-formula 0.1.1680167239.23f2fec-150400.3.3.3 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 cobbler 3.3.3-150400.5.25.3 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 cpu-mitigations-formula 0.5.0-150400.3.3.3 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 hub-xmlrpc-api 0.7-150400.5.6.5 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 perl-Satcon 4.3.2-150400.3.3.5 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 python-urlgrabber 4.1.0-150400.4.3.6.3 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 spacecmd 4.3.21-150400.3.18.5 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 spacewalk-admin 4.3.11-150400.3.6.6 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 spacewalk-backend 4.3.21-150400.3.21.13 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 spacewalk-config 4.3.10-150400.3.6.3 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 spacewalk-java 4.3.58-150400.3.46.4 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 spacewalk-search 4.3.9-150400.3.12.7 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 spacewalk-setup 4.3.16-150400.3.21.6 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 spacewalk-web 4.3.31-150400.3.21.7 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 supportutils-plugin-susemanager 4.3.7-150400.3.9.6 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 susemanager 4.3.27-150400.3.26.5 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 susemanager-build-keys 15.4.9-150400.3.20.2 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 susemanager-docs_en 4.3-150400.9.27.3 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 susemanager-schema 4.3.18-150400.3.18.7 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 susemanager-sls 4.3.33-150400.3.25.7 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 susemanager-tftpsync 4.3.4-150400.3.9.9 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 uyuni-common-libs 4.3.8-150400.3.12.5 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.3 virtual-host-gatherer 1.0.26-150400.3.12.3 SUSE-RU-2023:2566-1
SUSE Manager Server Module 4.2 branch-network-formula 0.1.1680167239.23f2fec-150300.3.6.2 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 cpu-mitigations-formula 0.5.0-150300.3.6.2 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 hub-xmlrpc-api 0.7-150300.3.12.3 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 inter-server-sync 0.2.8-150300.8.31.2 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 perl-Satcon 4.2.3-150300.3.3.3 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 spacecmd 4.2.23-150300.4.39.4 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 spacewalk-backend 4.2.28-150300.4.41.4 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 spacewalk-certs-tools 4.2.20-150300.3.30.4 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 spacewalk-java 4.2.50-150300.3.66.5 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 spacewalk-setup 4.2.12-150300.3.18.3 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 spacewalk-utils 4.2.19-150300.3.24.2 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 spacewalk-web 4.2.35-150300.3.44.4 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 supportutils-plugin-susemanager 4.2.7-150300.3.15.4 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 susemanager 4.2.42-150300.3.54.4 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 susemanager-build-keys 15.3.9-150300.3.14.1 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 susemanager-doc-indexes 4.2-150300.12.45.4 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 susemanager-docs_en 4.2-150300.12.45.2 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 susemanager-schema 4.2.28-150300.3.38.4 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 susemanager-sls 4.2.34-150300.3.51.1 SUSE-RU-2023:2595-1
SUSE Manager Server Module 4.2 virtual-host-gatherer 1.0.26-150300.3.15.2 SUSE-RU-2023:2595-1
SUSE Manager Server 4.3 release-notes-susemanager 4.3.6-150400.3.63.2 SUSE-SU-2023:4758-1, SUSE-RU-2023:2592-1
SUSE Manager Server 4.2 release-notes-susemanager 4.2.13-150300.3.81.1 SUSE-SU-2023:2594-1
SUSE Manager Proxy Module 4.3 mgr-daemon 4.3.7-150400.3.9.5 SUSE-RU-2023:2566-1
SUSE Manager Proxy Module 4.3 spacecmd 4.3.21-150400.3.18.5 SUSE-RU-2023:2566-1
SUSE Manager Proxy Module 4.3 spacewalk-backend 4.3.21-150400.3.21.13 SUSE-RU-2023:2566-1
SUSE Manager Proxy Module 4.3 spacewalk-proxy 4.3.16-150400.3.20.6 SUSE-RU-2023:2566-1
SUSE Manager Proxy Module 4.3 spacewalk-proxy-installer 4.3.11-150400.3.6.4 SUSE-RU-2023:2566-1
SUSE Manager Proxy Module 4.3 spacewalk-web 4.3.31-150400.3.21.7 SUSE-RU-2023:2566-1
SUSE Manager Proxy Module 4.3 susemanager-build-keys 15.4.9-150400.3.20.2 SUSE-RU-2023:2566-1
SUSE Manager Proxy Module 4.3 uyuni-common-libs 4.3.8-150400.3.12.5 SUSE-RU-2023:2566-1
SUSE Manager Proxy Module 4.2 spacecmd 4.2.23-150300.4.39.4 SUSE-RU-2023:2595-1
SUSE Manager Proxy Module 4.2 spacewalk-backend 4.2.28-150300.4.41.4 SUSE-RU-2023:2595-1
SUSE Manager Proxy Module 4.2 spacewalk-certs-tools 4.2.20-150300.3.30.4 SUSE-RU-2023:2595-1
SUSE Manager Proxy Module 4.2 spacewalk-proxy-installer 4.2.12-150300.3.17.2 SUSE-RU-2023:2595-1
SUSE Manager Proxy Module 4.2 spacewalk-ssl-cert-check 4.2.3-150300.3.3.2 SUSE-RU-2023:2595-1
SUSE Manager Proxy Module 4.2 spacewalk-web 4.2.35-150300.3.44.4 SUSE-RU-2023:2595-1
SUSE Manager Proxy Module 4.2 susemanager-build-keys 15.3.9-150300.3.14.1 SUSE-RU-2023:2595-1
SUSE Manager Proxy 4.3 release-notes-susemanager-proxy 4.3.6-150400.3.55.4 SUSE-SU-2023:4758-1, SUSE-RU-2023:2592-1
SUSE Manager Proxy 4.2 release-notes-susemanager-proxy 4.2.13-150300.3.64.2 SUSE-SU-2023:2594-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20241030T212825-1.1 openSUSE-SU-2024:14447-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
openSUSE Leap 15.5 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/neuvector/neuvector < 0.0.0-20231003121714-be746957ee7c 0.0.0-20231003121714-be746957ee7c GO-2024-3201

Advisories 9

References